ZyXEL Communications VMG1312-B Series User Manual Download

Page: 345 / 376

Appendix D Wireless LANs

VMG1312-B Series User’s Guide

345

WPA and WPA2

Wi- Fi Prot ect ed Access ( WPA) is a subset of t he I EEE 802.11i st andard. WPA2 ( I EEE 802.11i) is a
wireless securit y st andard t hat defines st ronger encrypt ion, aut hent icat ion and key m anagem ent
t han WPA.

Key differences bet ween WPA or WPA2 and WEP are im proved dat a encrypt ion and user
aut hent icat ion.

I f bot h an AP and t he wireless client s support  WPA2 and you have an ext ernal RADI US server, use
WPA2 for st ronger dat a encrypt ion. I f you don't  have an ext ernal RADI US server, you should use
WPA2- PSK ( WPA2- Pre- Shared Key)  t hat  only requires a single ( ident ical)  password ent ered int o
each access point , wireless gat eway and wireless client . As long as t he passwords m at ch, a wireless
client  will be grant ed access t o a WLAN.

I f t he AP or t he wireless client s do not support WPA2, j ust use WPA or WPA- PSK depending on
whet her you have an ext ernal RADI US server or not .

Select WEP only when t he AP and/ or wireless client s do not support WPA or WPA2. WEP is less
secure t han WPA or WPA2.

Encryption

WPA im proves dat a encrypt ion by using Tem poral Key I nt egrit y Prot ocol ( TKI P) , Message I nt egrit y
Check ( MI C) and I EEE 802.1x. WPA2 also uses TKI P when required for com pat ibilit y reasons, but
offers st ronger encrypt ion t han TKI P wit h Advanced Encrypt ion St andard ( AES) in t he Count er
m ode wit h Cipher block chaining Message aut hent icat ion code Prot ocol ( CCMP) .

TKI P uses 128- bit  keys t hat  are dynam ically generat ed and dist ribut ed by t he aut hent icat ion server.
AES ( Advanced Encrypt ion St andard)  is a block cipher t hat  uses a 256- bit  m at hem at ical algorit hm
called Rij ndael. They bot h include a per- packet  key m ixing funct ion, a Message I nt egrit y Check
( MI C)  nam ed Michael, an ext ended init ializat ion vect or ( I V)  wit h sequencing rules, and a re- keying
m echanism .

WPA and WPA2 regularly change and rot at e t he encrypt ion keys so t hat t he sam e encrypt ion key is
never used t wice.

The RADI US server dist ribut es a Pairwise Mast er Key ( PMK)  key t o t he AP t hat  t hen set s up a key
hierarchy and m anagem ent  syst em , using t he PMK t o dynam ically generat e unique dat a encrypt ion
keys t o encrypt  every dat a packet  t hat  is wirelessly com m unicat ed bet ween t he AP and t he wireless
client s. This all happens in t he background aut om at ically.

The Message I nt egrit y Check ( MI C)  is designed t o pr event  an at t acker from  capt uring dat a packet s,
alt ering t hem  and resending t hem . The MI C provides a st rong m at hem at ical funct ion in which t he
receiver and t he t ransm it t er each com put e and t hen com pare t he MI C. I f t hey do not  m at ch, it  is
assum ed t hat  t he dat a has been t am per ed wit h and t he packet  is dropped.

By generat ing unique dat a encrypt ion keys for every dat a packet  and by creat ing an int egrit y
checking m echanism  ( MI C) , wit h TKI P and AES it  is m ore difficult  t o decrypt  dat a on a Wi- Fi
net work t han WEP and difficult  for an int ruder t o break int o t he net work.

The encrypt ion m echanism s used for WPA( 2) and WPA( 2) - PSK are t he sam e. The only difference
bet ween t he t wo is t hat WPA( 2) - PSK uses a sim ple com m on password, inst ead of user- specific
credent ials. The com m on- password approach m akes WPA( 2) - PSK suscept ible t o brut e- force

ZyXEL Communications VMG1312-B Series, User Manual

Search results

Summary of Contents for VMG1312-B Series

Reviews:

Related manuals for VMG1312-B Series

Brands by name

Popular brands